Appendix 


Marriott recently learned that an unknown person gained access to information about 
certain Marriott associates by accessing the network of an outside vendor formerly used by 
Marriott. Once Marriott became aware, Marriott immediately confirmed that the vendor was taking 
appropriate steps to investigate the incident. The vendor reported that it was working with a 
forensic firm and had notified law enforcement. This vendor served as Marriott’s agent for 
receiving service of official documents, such as subpoenas and court orders. Documents regarding 
certain Marriott associates had been sent to this vendor and were accessed or accessible during the 
incident. The information that was in the documents involved includes the names, addresses, and 
Social Security numbers of 1,552 California residents. 

Beginning today, October 30, 2019, Marriott notified the individuals involved by mailing 
a letter through United States First Class mail in accordance with Cal. Civ. Code § 1798.82(j)(4). 
A sample of the notification letter is attached. Marriott is providing the individuals with credit 
monitoring and identity theft protection services through Experian. Marriott has also made a 
dedicated call center available to answer questions from the individuals. 

The vendor provided Marriott with a list of the Marriott associates involved but the list did 
not contain a mailing address for most. Marriott has been working to identify addresses for all 
associates. There are a few associates left where Marriott is still working to find an address. 
Marriott will mail letters to those few remaining associates as soon as the addresses are found. We 
will notify you if any of those associates are California residents. 

The security of personal information continues to be a top priority for Marriott. Marriott 
has already terminated its relationship with the vendor, and the vendor confirmed that it has 
securely removed all information regarding Marriott associates from its network. 
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